Apple’s iOS 13.3 should be coming to your iPhone pretty soon, and with it a bunch of cool new features. One of the interesting and exciting iOS 13.3 updates for anyone who is concerned about their security is the ability to use security keys with Apple’s Safari browser.
The move is revealed in Apple’s release notes for the second developer beta, which says iOS 13.3 supports NFC, USB, and Lightning FIDO2-compliant security keys in Safari.
In other words, when the iOS 13.3 update drops, you will able to use physical security keys such as Yubico’s iPhone compatible YubiKey 5Ci–which was previously unavailable to browsers such as Apple’s Safari and Google’s Chrome. However, it could be used with some password manager apps such as 1Password.
It is expected that iOS 13.3 will probably hit sometime in December. So what’s the deal with security keys?
Security keys in iOS 13.3: A great idea
A security key is a convenient and secure form of authentication because you can simply plug it into your device.
Security researcher Sean Wright goes one step further, saying security keys are “fantastic.”
“Keys are a rare case in security where a good mechanism comes with something that is relatively easy to use. They represent a desire to move away from password based authentication to something that is often more secure as well as hopefully more user friendly.”
He points out that security keys also prevent phishing attempts, where an attacker will try to steal your details by, for example, sending you an email prompting you to enter your credentials onto a fake page.
ZeroDayLab’s director of cyber security strategy, Stuart Peck agrees the move is a “great idea.” However, he points out that support for YubiKey is limited–although this is likely to change over time.
But like any form of authentication, security keys aren’t bulletproof. You might even want to avoid carrying them around with you, especially if there is a chance they may get lost. “Like any key, you will want to ensure that you keep them safe, and avoid leaving them around and losing them,” Wright says.
In order to protect yourself while still getting the most benefit out of the key, Wright advises having another means–perhaps another backup key–to access your account. “So if you lost your key or it was stolen you would immediately revoke it.”
Security keys in iOS 13.3: Should you use one?
It’s an exciting change, and security keys are a definite yes for a technical user who is concerned about their data. However, Peck thinks they could be overkill for the average person. “Unless your personal threat model requires the use of security keys, an app for two factor authentication is just as acceptable.”
Apple’s iOS 13 is certainly moving in the right direction for security and privacy. The iPhone maker has added a host of new security features to the updated operating system including the ability to lock down its voice assistant Siri.
It has also introduced new features that could be a blow to firms such as Facebook and Google by highlighting how much data they collect in the background and giving you the opportunity to prevent this.
Personally, I’m looking forward to iOS 13.3 and the ability to try out a security key on my device. But it isn’t for everyone–and it’s certainly not something you’d want to lose–so if you do use one make sure you have a back up.